Executive brief
Search Guard FLX, a security plugin for Elasticsearch and Kibana, contains a vulnerability where user login credentials may be inadvertently recorded in audit logs. If an unauthorized person gains access to these log files, they could obtain plain-text passwords, leading to account takeovers and unauthorized access to sensitive data. This issue affects organizations using the audit logging feature during Kibana login events.
Technical details
A vulnerability in the audit logging feature of Search Guard FLX (versions 1.0.0 to 4.0.1) can lead to the insertion of sensitive information into log files (CWE-532). Specifically, when users log into Kibana, the audit log may capture the request body containing plain-text credentials. An attacker with access to the audit logs—typically requiring high privileges or local access—could retrieve these credentials to impersonate users. The issue is rooted in the KIBANA_LOGIN and KIBANA_LOGOUT event handling. A fix is available in version 4.1.0, which properly excludes sensitive headers and provides more granular control over request-body logging. Temporary mitigations include disabling request-body logging globally or specifically for the authentication session path.
Affected products
- floragunn Search Guard FLX 1.0.0 - 4.0.1
Timeline
- 2026-03-25: patched: Version 4.1.0 released.
- 2026-03-31: disclosed: Initial advisory publication.
- 2026-03-31: advisory: NVD entry published.